pro/im_server
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

refactor(server/auth): 移除账号掩码函数并简化审计日志存储

Browse Source 
1.  移除不再使用的maskLoginAccount工具函数
2.  登录审计日志直接存储原始账号而非掩码后的版本
3.  重命名测试函数以匹配新的业务逻辑
This commit is contained in:
Austin
2026-09-21 17:50:55 +08:00
parent 55c59878cf
commit 9820e89e1c
2 changed files with 3 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/auth_audit.go
+2 -20
View File
@@ -42,7 +42,7 @@ func recordSessionLoginSuccess(s *Session, rec *auth.Rec, scheme, suppliedAccoun
}
event := &types.LoginAuditEvent{
UserID: rec.Uid, Username: username, AccountType: accountType,
AccountHash: hashLoginAccount(account), AccountMask: maskLoginAccount(account),
AccountHash: hashLoginAccount(account), AccountMask: account,
LoginType: loginAuditType(scheme), EventType: "login", SessionID: truncateAuditValue(s.sid, 96),
DeviceID: truncateAuditValue(s.deviceID, 255), Platform: normalizeAuditPlatform(s.platf),
AppVersion: truncateAuditValue(versionToString(s.ver), 32), IP: sessionAuditIP(s.remoteAddr),
@@ -79,7 +79,7 @@ func recordSessionLoginFailure(s *Session, scheme string, secret []byte, rec *au
riskLevel = "high"
}
event := &types.LoginFailureEvent{
UserID: uid, AccountType: accountType, AccountHash: hashLoginAccount(account), AccountMask: maskLoginAccount(account),
UserID: uid, AccountType: accountType, AccountHash: hashLoginAccount(account), AccountMask: account,
FailureType: failureType, Reason: reason, Detail: truncateAuditValue(loginFailureDetail(cause), 500),
IP: sessionAuditIP(s.remoteAddr), DeviceID: truncateAuditValue(s.deviceID, 255), Platform: normalizeAuditPlatform(s.platf),
AppVersion: truncateAuditValue(versionToString(s.ver), 32), UserAgent: truncateAuditValue(s.userAgent, 512),
@@ -241,24 +241,6 @@ func isPhoneLike(value string) bool {
return digits >= 7
}
func maskLoginAccount(account string) string {
account = strings.TrimSpace(account)
if account == "" {
return ""
}
if at := strings.LastIndex(account, "@"); at > 0 {
return string([]rune(account[:at])[:1]) + "***" + account[at:]
}
runes := []rune(account)
if isPhoneLike(account) && len(runes) > 7 {
return string(runes[:3]) + "****" + string(runes[len(runes)-4:])
}
if len(runes) <= 2 {
return strings.Repeat("*", len(runes))
}
return string(runes[:1]) + strings.Repeat("*", len(runes)-2) + string(runes[len(runes)-1:])
}
func hashLoginAccount(account string) string {
account = strings.ToLower(strings.TrimSpace(account))
if account == "" {
server/auth_audit_test.go
+1 -12
View File
@@ -22,18 +22,7 @@ func TestLoginAuditAccountDoesNotTreatTokenAsAccount(t *testing.T) {
}
}
func TestMaskAndHashLoginAccount(t *testing.T) {
tests := map[string]string{
"13800138000": "138****8000",
"alice@example.com": "a***@example.com",
"alice": "a***e",
"ab": "**",
}
for input, want := range tests {
if got := maskLoginAccount(input); got != want {
t.Errorf("maskLoginAccount(%q)=%q want %q", input, got, want)
}
}
func TestHashLoginAccount(t *testing.T) {
hash := hashLoginAccount(" Alice ")
if len(hash) != 64 || hash != hashLoginAccount("alice") || strings.Contains(hash, "alice") {
t.Fatalf("unexpected account hash %q", hash)